AI chatbots feel private, but the data you share can be stored, processed, and sometimes used for training. Here is a practical guide to what you should never tell an AI, and how to protect your privacy under GDPR and UK data protection law.
Conversational AI feels intimate — like texting a trusted friend. But behind that friendly interface sits infrastructure that may log your inputs, retain them for a period, and in some cases use them to improve future models. Understanding what not to share is one of the most important AI safety skills you can develop.
This applies whether you use a free chatbot, an enterprise assistant, or an AI agent embedded in an app. The golden rule: treat anything you type into an AI as potentially recoverable by a third party.
Avoid sharing your full name alongside your home address, date of birth, National Insurance number, passport number, or driving licence details. Individually these may seem harmless; combined, they enable identity theft. Under UK GDPR, such data is "personal data" and deserves careful handling — including by you.
Never enter bank account numbers, sort codes, card numbers, CVV codes, or online banking credentials. No legitimate AI assistant needs these. If a tool asks for them in a chat window, treat it as a red flag for a potential scam.
Do not paste passwords, PINs, two-factor recovery codes, or API keys into a chatbot — even to ask for help formatting or remembering them. Use a dedicated password manager instead. Credentials shared in a chat may be logged and are impossible to fully retract.
Health information is "special category data" under UK GDPR and carries heightened protections. While asking general questions about symptoms is reasonable, avoid uploading medical records, test results tied to your identity, or detailed histories. For clinical decisions, consult a qualified professional rather than a general-purpose AI.
Employees have inadvertently leaked source code, unreleased financials, and client contracts by pasting them into public chatbots. If your organisation has not approved a specific tool for confidential data, assume it is off-limits. Many enterprises now deploy private, ring-fenced AI precisely to avoid this risk.
Be cautious about uploading photographs of your face, fingerprints, or voice recordings to unfamiliar AI services. Biometric identifiers cannot be changed if compromised, and some tools retain uploaded media for model training unless you opt out.
Never share information about children — names, schools, photographs, routines, or locations. UK data protection rules impose additional safeguards for children's data, and the safeguarding risks of exposing it online are severe.
AI companions and chatbots are increasingly persuasive. Be aware that a system designed to maximise engagement may encourage you to disclose more than you intended, or foster dependency. Maintain healthy scepticism, particularly with tools that adopt a personal or emotional tone.
Under UK GDPR you have the right to access the data an organisation holds about you, to request its deletion, and to object to certain processing. If an AI provider processes your personal data, these rights apply. Reputable providers publish a Data Protection contact and honour subject access requests.
AI is a powerful assistant, but privacy is your responsibility as much as the provider's. Share thoughtfully, anonymise where you can, and never disclose credentials, financial details, or sensitive personal data. For more on choosing trustworthy tools, see our guides Where Can I Use AI for Free? and Best AI Tools for 2026. At ArtificialIntelligence.com.ai, developed by Ask AI Artificial Intelligence Integration, we review AI platforms with privacy and safety front of mind — helping you adopt AI confidently and responsibly.
Topics
Explore ArtificialIntelligence.com.ai
Browse our verified directory of 125+ AI professionals, tools, and premium .ai domains — all in one place.